@cursor/bdk 0.2.9 → 0.2.10

package/dist/channels/bitbucket/binding.js

@@ -24,21 +24,20 @@ export function buildBitbucketBinding(input) {
     let client;
     let api;
     const getClient = () => {
-        var _a;
-        client !== null && client !== void 0 ? client : (client = createBitbucketClient({
+        client ??= createBitbucketClient({
             proxy: input.proxy,
             token: input.token,
             // Never derive the credentialed host from the delivery's repository
             // link: a signed-but-forged payload must not choose where the token
             // goes. Data Center deploys set BITBUCKET_API_BASE_URL / apiBaseUrl.
-            apiBaseUrl: (_a = input.apiBaseUrl) !== null && _a !== void 0 ? _a : bitbucketApiBaseUrl({ dialect: input.repository.dialect }),
+            apiBaseUrl: input.apiBaseUrl ?? bitbucketApiBaseUrl({ dialect: input.repository.dialect }),
             repo: input.repository.fullName,
             fetch: input.fetch,
-        }));
+        });
         return client;
     };
     const getApi = () => {
-        api !== null && api !== void 0 ? api : (api = createBitbucketApi(getClient(), input.repository));
+        api ??= createBitbucketApi(getClient(), input.repository);
         return api;
     };
     return {
@@ -48,7 +47,7 @@ export function buildBitbucketBinding(input) {
         },
         request: request => getClient().request(request),
         setBuildStatus: status => getApi().setBuildStatus(status),
-        createCheck: check => createBitbucketCheck(Object.assign(Object.assign({}, check), { bitbucket: getApi() })),
+        createCheck: check => createBitbucketCheck({ ...check, bitbucket: getApi() }),
     };
 }
 export function asRecord(value) {
@@ -73,22 +72,20 @@ function asBoolean(value) {
 }
 /** Data Center `links.self[0].href`; Cloud `links.html.href`. */
 function linkHref(links) {
-    var _a, _b, _c;
     const record = asRecord(links);
-    const html = asNonEmptyString((_a = asRecord(record === null || record === void 0 ? void 0 : record.html)) === null || _a === void 0 ? void 0 : _a.href);
+    const html = asNonEmptyString(asRecord(record?.html)?.href);
     if (html !== undefined) {
         return html;
     }
-    const self = record === null || record === void 0 ? void 0 : record.self;
+    const self = record?.self;
     if (Array.isArray(self)) {
-        return asNonEmptyString((_b = asRecord(self[0])) === null || _b === void 0 ? void 0 : _b.href);
+        return asNonEmptyString(asRecord(self[0])?.href);
     }
-    return asNonEmptyString((_c = asRecord(self)) === null || _c === void 0 ? void 0 : _c.href);
+    return asNonEmptyString(asRecord(self)?.href);
 }
 /** The pull-request record under either dialect's key. */
 export function bitbucketPullRequestRecord(payload) {
-    var _a;
-    return (_a = asRecord(payload.pullrequest)) !== null && _a !== void 0 ? _a : asRecord(payload.pullRequest);
+    return asRecord(payload.pullrequest) ?? asRecord(payload.pullRequest);
 }
 /**
  * Cloud bodies carry `pullrequest` / `repository.full_name`; Data Center
@@ -96,16 +93,14 @@ export function bitbucketPullRequestRecord(payload) {
  * default to Cloud, the dialect the hosted ingress normalizes toward.
  */
 export function bitbucketDialectOf(payload) {
-    var _a;
     if (asRecord(payload.pullRequest) !== undefined ||
         asNonEmptyString(payload.eventKey) !== undefined ||
-        asRecord((_a = asRecord(payload.repository)) === null || _a === void 0 ? void 0 : _a.project) !== undefined) {
+        asRecord(asRecord(payload.repository)?.project) !== undefined) {
         return "data-center";
     }
     return "cloud";
 }
 function repositoryFromRecord(dialect, repository) {
-    var _a;
     if (repository === undefined) {
         return undefined;
     }
@@ -117,52 +112,67 @@ function repositoryFromRecord(dialect, repository) {
             return undefined;
         }
         const uuid = asNonEmptyString(repository.uuid);
-        return Object.assign(Object.assign({ dialect,
+        return {
+            dialect,
             fullName,
-            owner, slug: rest.join("/") }, (uuid === undefined ? {} : { uuid })), (htmlUrl === undefined ? {} : { htmlUrl }));
+            owner,
+            slug: rest.join("/"),
+            ...(uuid === undefined ? {} : { uuid }),
+            ...(htmlUrl === undefined ? {} : { htmlUrl }),
+        };
     }
-    const projectKey = asNonEmptyString((_a = asRecord(repository.project)) === null || _a === void 0 ? void 0 : _a.key);
+    const projectKey = asNonEmptyString(asRecord(repository.project)?.key);
     const slug = asNonEmptyString(repository.slug);
     if (projectKey === undefined || slug === undefined) {
         return undefined;
     }
     const id = asPositiveInt(repository.id);
-    return Object.assign(Object.assign({ dialect, fullName: `${projectKey}/${slug}`, owner: projectKey, slug }, (id === undefined ? {} : { id })), (htmlUrl === undefined ? {} : { htmlUrl }));
+    return {
+        dialect,
+        fullName: `${projectKey}/${slug}`,
+        owner: projectKey,
+        slug,
+        ...(id === undefined ? {} : { id }),
+        ...(htmlUrl === undefined ? {} : { htmlUrl }),
+    };
 }
 /**
  * Repository the delivery is about. Top-level `repository` (Cloud always;
  * DC on `repo:*`), else the DC pull request's `toRef.repository`.
  */
 export function bitbucketRepositoryFromPayload(payload) {
-    var _a, _b;
-    var _c;
     const dialect = bitbucketDialectOf(payload);
-    return ((_c = repositoryFromRecord(dialect, asRecord(payload.repository))) !== null && _c !== void 0 ? _c : repositoryFromRecord(dialect, asRecord((_b = asRecord((_a = bitbucketPullRequestRecord(payload)) === null || _a === void 0 ? void 0 : _a.toRef)) === null || _b === void 0 ? void 0 : _b.repository)));
+    return (repositoryFromRecord(dialect, asRecord(payload.repository)) ??
+        repositoryFromRecord(dialect, asRecord(asRecord(bitbucketPullRequestRecord(payload)?.toRef)?.repository)));
 }
 /** Cloud `{uuid, display_name, nickname}` or DC `{id, name, displayName}`. */
 export function bitbucketUser(value) {
-    var _a, _b, _c, _d, _e;
     const record = asRecord(value);
     if (record === undefined) {
         return undefined;
     }
     // DC wraps PR authors as `{ user: {...}, role, approved }`.
-    const user = (_a = asRecord(record.user)) !== null && _a !== void 0 ? _a : record;
-    const id = (_c = (_b = asNonEmptyString(user.uuid)) !== null && _b !== void 0 ? _b : asNonEmptyString(user.account_id)) !== null && _c !== void 0 ? _c : (asPositiveInt(user.id) === undefined ? undefined : String(asPositiveInt(user.id)));
+    const user = asRecord(record.user) ?? record;
+    const id = asNonEmptyString(user.uuid) ??
+        asNonEmptyString(user.account_id) ??
+        (asPositiveInt(user.id) === undefined ? undefined : String(asPositiveInt(user.id)));
     if (id === undefined) {
         return undefined;
     }
-    const displayName = (_d = asNonEmptyString(user.display_name)) !== null && _d !== void 0 ? _d : asNonEmptyString(user.displayName);
-    const username = (_e = asNonEmptyString(user.nickname)) !== null && _e !== void 0 ? _e : asNonEmptyString(user.name);
-    return Object.assign(Object.assign({ id }, (displayName === undefined ? {} : { displayName })), (username === undefined ? {} : { username }));
+    const displayName = asNonEmptyString(user.display_name) ?? asNonEmptyString(user.displayName);
+    const username = asNonEmptyString(user.nickname) ?? asNonEmptyString(user.name);
+    return {
+        id,
+        ...(displayName === undefined ? {} : { displayName }),
+        ...(username === undefined ? {} : { username }),
+    };
 }
 export function bitbucketPullRequestUrl(repository, id, explicit) {
-    var _a;
     if (explicit !== undefined) {
         return explicit;
     }
     if (repository.dialect === "cloud") {
-        return `${(_a = repository.htmlUrl) !== null && _a !== void 0 ? _a : `https://bitbucket.org/${repository.fullName}`}/pull-requests/${id}`;
+        return `${repository.htmlUrl ?? `https://bitbucket.org/${repository.fullName}`}/pull-requests/${id}`;
     }
     return repository.htmlUrl === undefined
         ? `projects/${repository.owner}/repos/${repository.slug}/pull-requests/${id}`
@@ -189,10 +199,8 @@ export function bitbucketDraftMarkedReady(payload, draft) {
  * the Cloud-normalized event key (`pullrequest:created` → `created`).
  */
 export function bitbucketPullRequestFromPayload(repository, payload, action) {
-    var _a, _b, _c;
-    var _d, _e, _f;
     const record = bitbucketPullRequestRecord(payload);
-    const id = asPositiveInt(record === null || record === void 0 ? void 0 : record.id);
+    const id = asPositiveInt(record?.id);
     if (record === undefined || id === undefined) {
         return undefined;
     }
@@ -205,46 +213,64 @@ export function bitbucketPullRequestFromPayload(repository, payload, action) {
     const destination = asRecord(record.destination);
     const fromRef = asRecord(record.fromRef);
     const toRef = asRecord(record.toRef);
-    const sourceBranch = (_d = asNonEmptyString((_a = asRecord(source === null || source === void 0 ? void 0 : source.branch)) === null || _a === void 0 ? void 0 : _a.name)) !== null && _d !== void 0 ? _d : asNonEmptyString(fromRef === null || fromRef === void 0 ? void 0 : fromRef.displayId);
-    const targetBranch = (_e = asNonEmptyString((_b = asRecord(destination === null || destination === void 0 ? void 0 : destination.branch)) === null || _b === void 0 ? void 0 : _b.name)) !== null && _e !== void 0 ? _e : asNonEmptyString(toRef === null || toRef === void 0 ? void 0 : toRef.displayId);
-    const headSha = (_f = asNonEmptyString((_c = asRecord(source === null || source === void 0 ? void 0 : source.commit)) === null || _c === void 0 ? void 0 : _c.hash)) !== null && _f !== void 0 ? _f : asNonEmptyString(fromRef === null || fromRef === void 0 ? void 0 : fromRef.latestCommit);
+    const sourceBranch = asNonEmptyString(asRecord(source?.branch)?.name) ?? asNonEmptyString(fromRef?.displayId);
+    const targetBranch = asNonEmptyString(asRecord(destination?.branch)?.name) ?? asNonEmptyString(toRef?.displayId);
+    const headSha = asNonEmptyString(asRecord(source?.commit)?.hash) ?? asNonEmptyString(fromRef?.latestCommit);
     const previousHeadSha = asNonEmptyString(payload.previousFromHash);
     const author = bitbucketUser(record.author);
     const title = asNonEmptyString(record.title);
     const state = asNonEmptyString(record.state);
     const draft = asBoolean(record.draft);
-    return Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({ action,
-        id }, (title === undefined ? {} : { title })), (description === undefined ? {} : { description })), (state === undefined ? {} : { state })), (draft === undefined ? {} : { draft })), (sourceBranch === undefined ? {} : { sourceBranch })), (targetBranch === undefined ? {} : { targetBranch })), (headSha === undefined ? {} : { headSha })), (previousHeadSha === undefined ? {} : { previousHeadSha })), (author === undefined ? {} : { author })), { htmlUrl: bitbucketPullRequestUrl(repository, id, linkHref(record.links)) });
+    return {
+        action,
+        id,
+        ...(title === undefined ? {} : { title }),
+        ...(description === undefined ? {} : { description }),
+        ...(state === undefined ? {} : { state }),
+        ...(draft === undefined ? {} : { draft }),
+        ...(sourceBranch === undefined ? {} : { sourceBranch }),
+        ...(targetBranch === undefined ? {} : { targetBranch }),
+        ...(headSha === undefined ? {} : { headSha }),
+        ...(previousHeadSha === undefined ? {} : { previousHeadSha }),
+        ...(author === undefined ? {} : { author }),
+        htmlUrl: bitbucketPullRequestUrl(repository, id, linkHref(record.links)),
+    };
 }
 /** Cloud `comment.content.raw` / DC `comment.text`. */
 export function bitbucketCommentFromPayload(payload) {
-    var _a, _b;
-    var _c;
     const comment = asRecord(payload.comment);
-    const id = asPositiveInt(comment === null || comment === void 0 ? void 0 : comment.id);
-    const body = typeof ((_a = asRecord(comment === null || comment === void 0 ? void 0 : comment.content)) === null || _a === void 0 ? void 0 : _a.raw) === "string"
-        ? (_b = asRecord(comment === null || comment === void 0 ? void 0 : comment.content)) === null || _b === void 0 ? void 0 : _b.raw
-        : typeof (comment === null || comment === void 0 ? void 0 : comment.text) === "string"
+    const id = asPositiveInt(comment?.id);
+    const body = typeof asRecord(comment?.content)?.raw === "string"
+        ? asRecord(comment?.content)?.raw
+        : typeof comment?.text === "string"
             ? comment.text
             : undefined;
     if (comment === undefined || id === undefined || body === undefined) {
         return undefined;
     }
-    const author = bitbucketUser((_c = comment.user) !== null && _c !== void 0 ? _c : comment.author);
+    const author = bitbucketUser(comment.user ?? comment.author);
     const htmlUrl = linkHref(comment.links);
     const inlineRecord = asRecord(comment.inline);
     const inline = inlineRecord === undefined
         ? undefined
-        : Object.assign(Object.assign(Object.assign({}, (asNonEmptyString(inlineRecord.path) === undefined
-            ? {}
-            : { path: asNonEmptyString(inlineRecord.path) })), (typeof inlineRecord.to === "number" ? { to: inlineRecord.to } : {})), (typeof inlineRecord.from === "number" ? { from: inlineRecord.from } : {}));
-    return Object.assign(Object.assign(Object.assign({ id,
-        body }, (author === undefined ? {} : { author })), (htmlUrl === undefined ? {} : { htmlUrl })), (inline === undefined ? {} : { inline }));
+        : {
+            ...(asNonEmptyString(inlineRecord.path) === undefined
+                ? {}
+                : { path: asNonEmptyString(inlineRecord.path) }),
+            ...(typeof inlineRecord.to === "number" ? { to: inlineRecord.to } : {}),
+            ...(typeof inlineRecord.from === "number" ? { from: inlineRecord.from } : {}),
+        };
+    return {
+        id,
+        body,
+        ...(author === undefined ? {} : { author }),
+        ...(htmlUrl === undefined ? {} : { htmlUrl }),
+        ...(inline === undefined ? {} : { inline }),
+    };
 }
 /** Cloud `push.changes[]` (`new`/`old` targets) or DC `changes[]` (`toHash`/`fromHash`). */
 export function bitbucketPushFromPayload(payload) {
-    var _a;
-    const cloudChanges = (_a = asRecord(payload.push)) === null || _a === void 0 ? void 0 : _a.changes;
+    const cloudChanges = asRecord(payload.push)?.changes;
     const changes = Array.isArray(cloudChanges)
         ? cloudChanges
         : Array.isArray(payload.changes)
@@ -255,8 +281,6 @@ export function bitbucketPushFromPayload(payload) {
     }
     return {
         changes: changes.flatMap(entry => {
-            var _a, _b, _c;
-            var _d, _e, _f, _g, _h, _j, _k, _l;
             const change = asRecord(entry);
             if (change === undefined) {
                 return [];
@@ -264,13 +288,25 @@ export function bitbucketPushFromPayload(payload) {
             const next = asRecord(change.new);
             const previous = asRecord(change.old);
             const ref = asRecord(change.ref);
-            const name = (_e = (_d = asNonEmptyString(next === null || next === void 0 ? void 0 : next.name)) !== null && _d !== void 0 ? _d : asNonEmptyString(previous === null || previous === void 0 ? void 0 : previous.name)) !== null && _e !== void 0 ? _e : asNonEmptyString(ref === null || ref === void 0 ? void 0 : ref.displayId);
-            const refId = (_g = (_f = asNonEmptyString(change.refId)) !== null && _f !== void 0 ? _f : asNonEmptyString(ref === null || ref === void 0 ? void 0 : ref.id)) !== null && _g !== void 0 ? _g : (name === undefined ? undefined : `refs/heads/${name}`);
-            const type = (_j = (_h = asNonEmptyString(next === null || next === void 0 ? void 0 : next.type)) !== null && _h !== void 0 ? _h : asNonEmptyString(previous === null || previous === void 0 ? void 0 : previous.type)) !== null && _j !== void 0 ? _j : (_a = asNonEmptyString(ref === null || ref === void 0 ? void 0 : ref.type)) === null || _a === void 0 ? void 0 : _a.toLowerCase();
-            const before = (_k = asNonEmptyString((_b = asRecord(previous === null || previous === void 0 ? void 0 : previous.target)) === null || _b === void 0 ? void 0 : _b.hash)) !== null && _k !== void 0 ? _k : asNonEmptyString(change.fromHash);
-            const after = (_l = asNonEmptyString((_c = asRecord(next === null || next === void 0 ? void 0 : next.target)) === null || _c === void 0 ? void 0 : _c.hash)) !== null && _l !== void 0 ? _l : asNonEmptyString(change.toHash);
+            const name = asNonEmptyString(next?.name) ??
+                asNonEmptyString(previous?.name) ??
+                asNonEmptyString(ref?.displayId);
+            const refId = asNonEmptyString(change.refId) ??
+                asNonEmptyString(ref?.id) ??
+                (name === undefined ? undefined : `refs/heads/${name}`);
+            const type = asNonEmptyString(next?.type) ??
+                asNonEmptyString(previous?.type) ??
+                asNonEmptyString(ref?.type)?.toLowerCase();
+            const before = asNonEmptyString(asRecord(previous?.target)?.hash) ?? asNonEmptyString(change.fromHash);
+            const after = asNonEmptyString(asRecord(next?.target)?.hash) ?? asNonEmptyString(change.toHash);
             return [
-                Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({}, (refId === undefined ? {} : { ref: refId })), (name === undefined ? {} : { name })), (before === undefined ? {} : { before })), (after === undefined ? {} : { after })), (type === undefined ? {} : { type })),
+                {
+                    ...(refId === undefined ? {} : { ref: refId }),
+                    ...(name === undefined ? {} : { name }),
+                    ...(before === undefined ? {} : { before }),
+                    ...(after === undefined ? {} : { after }),
+                    ...(type === undefined ? {} : { type }),
+                },
             ];
         }),
     };

package/dist/channels/bitbucket/bitbucket-channel.d.ts

@@ -1,7 +1,21 @@
-import type { ChannelDefinition } from "../../types.js";
+import { type AuthPolicy, type ChannelDefinition } from "../../types.js";
 import { type BitbucketChannelState } from "./state.js";
 import type { BitbucketChannelOptions } from "./types.js";
 export declare function getBitbucketChannelOptions(definition: object): BitbucketChannelOptions | undefined;
+/**
+ * Why a `bitbucketChannel` cannot deploy onto architecture v2 as authored,
+ * or `undefined` when it can: v2 needs a named `webhookSecret` so the
+ * control plane can verify `X-Hub-Signature` before any compute starts.
+ */
+export declare function bitbucketChannelArchitectureError(definition: object): string | undefined;
+/**
+ * The route policy for a Bitbucket webhook whose secret is named: verify
+ * `X-Hub-Signature` under the env var / deployment secret `secretName`.
+ * Being an {@link hmacSignatureAuth} policy, `deploy` writes it into the
+ * manifest, so on Cursor hosting the control plane runs the same check at
+ * ingestion and refuses a bad signature before any compute starts.
+ */
+export declare function bitbucketWebhookSignatureAuth(secretName: string): AuthPolicy;
 export declare function bitbucketChannel(options?: BitbucketChannelOptions): ChannelDefinition<BitbucketChannelState>;
 /** Minimal mount shape shared by `serve` / the `bitbucket` CLI. */
 export interface BitbucketAgentMountLike {

package/dist/channels/bitbucket/bitbucket-channel.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bitbucket-channel.d.ts","sourceRoot":"","sources":["../../../src/channels/bitbucket/bitbucket-channel.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAaxD,OAAO,EAAE,KAAK,qBAAqB,EAA8B,MAAM,YAAY,CAAC;AACpF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAI1D,wBAAgB,0BAA0B,CACxC,UAAU,EAAE,MAAM,GACjB,uBAAuB,GAAG,SAAS,CAErC;AAED,wBAAgB,gBAAgB,CAC9B,OAAO,GAAE,uBAA4B,GACpC,iBAAiB,CAAC,qBAAqB,CAAC,CAqF1C;AAED,mEAAmE;AACnE,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE;QACP,QAAQ,EAAE,KAAK,CAAC;YACd,EAAE,EAAE,MAAM,CAAC;YACX,UAAU,EAAE;gBACV,IAAI,CAAC,EAAE;oBAAE,IAAI,CAAC,EAAE,MAAM,CAAC;oBAAC,sBAAsB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;iBAAE,CAAC;gBACrE,MAAM,CAAC,EAAE,aAAa,CAAC;oBAAE,MAAM,EAAE,MAAM,CAAC;oBAAC,IAAI,EAAE,MAAM,CAAA;iBAAE,CAAC,CAAC;aAC1D,CAAC;SACH,CAAC,CAAC;KACJ,CAAC;CACH;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,kDAAkD;IAClD,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,aAAa,CAAC,uBAAuB,CAAC,GAC7C,sBAAsB,EAAE,CAkB1B"}
+{"version":3,"file":"bitbucket-channel.d.ts","sourceRoot":"","sources":["../../../src/channels/bitbucket/bitbucket-channel.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAE,KAAK,UAAU,EAAE,KAAK,iBAAiB,EAAe,MAAM,gBAAgB,CAAC;AAetF,OAAO,EAAE,KAAK,qBAAqB,EAA8B,MAAM,YAAY,CAAC;AACpF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAI1D,wBAAgB,0BAA0B,CACxC,UAAU,EAAE,MAAM,GACjB,uBAAuB,GAAG,SAAS,CAErC;AAED;;;;GAIG;AACH,wBAAgB,iCAAiC,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAWxF;AAED;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAAC,UAAU,EAAE,MAAM,GAAG,UAAU,CAM5E;AAyBD,wBAAgB,gBAAgB,CAC9B,OAAO,GAAE,uBAA4B,GACpC,iBAAiB,CAAC,qBAAqB,CAAC,CA4F1C;AAED,mEAAmE;AACnE,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE;QACP,QAAQ,EAAE,KAAK,CAAC;YACd,EAAE,EAAE,MAAM,CAAC;YACX,UAAU,EAAE;gBACV,IAAI,CAAC,EAAE;oBAAE,IAAI,CAAC,EAAE,MAAM,CAAC;oBAAC,sBAAsB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;iBAAE,CAAC;gBACrE,MAAM,CAAC,EAAE,aAAa,CAAC;oBAAE,MAAM,EAAE,MAAM,CAAC;oBAAC,IAAI,EAAE,MAAM,CAAA;iBAAE,CAAC,CAAC;aAC1D,CAAC;SACH,CAAC,CAAC;KACJ,CAAC;CACH;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,kDAAkD;IAClD,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,aAAa,CAAC,uBAAuB,CAAC,GAC7C,sBAAsB,EAAE,CAkB1B"}

package/dist/channels/bitbucket/bitbucket-channel.js

@@ -1,19 +1,14 @@
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
 import { z } from "zod";
-import { allowAll, defineChannel, localDevStrict, loopbackOnly, POST } from "../../channels.js";
+import { allowAll, defineChannel, hmacSignatureAuth, localDevStrict, loopbackOnly, POST, } from "../../channels.js";
 import { withPropagatingBackgroundErrors } from "../../internal/channel-dispatch.js";
 import { normalizeIdentity } from "../../internal/continuation-identity.js";
 import { isDevMode } from "../../internal/dev-mode.js";
 import { attachHostedAdmissionAdapter } from "../../internal/hosted-admission-adapter.js";
-import { dispatchBitbucketWebhook, handleBitbucketWebhookRequest, parseBitbucketWebhookPayload, resolveBitbucketWebhookSecret, } from "./bitbucket-webhook.js";
+import { replayCatchRequest } from "../../internal/hosted-catch.js";
+import { AGENT_SDK_CATCH_EVENT_TYPE } from "../../internal/hosted-catch-protocol.js";
+import { envSecretRef, namedWebhookSecretArchitectureError, } from "../../internal/named-webhook-secret.js";
+import { isSecretRef } from "../../types.js";
+import { BITBUCKET_SIGNATURE_HEADER, BITBUCKET_SIGNATURE_PREFIX, BITBUCKET_WEBHOOK_SECRET_ENV, dispatchBitbucketWebhook, handleBitbucketWebhookRequest, parseBitbucketWebhookPayload, } from "./bitbucket-webhook.js";
 import { createPendingCursorBitbucketCredentials, parseCursorBitbucketRepoScope, registerBitbucketCursorAccountRuntime, } from "./cursor-account.js";
 import { BITBUCKET_CHANNEL_KIND, deriveBitbucketWebhookEvents } from "./events.js";
 import { emptyBitbucketChannelState } from "./state.js";
@@ -21,21 +16,65 @@ const bitbucketChannelOptionsByDefinition = new WeakMap();
 export function getBitbucketChannelOptions(definition) {
     return bitbucketChannelOptionsByDefinition.get(definition);
 }
+/**
+ * Why a `bitbucketChannel` cannot deploy onto architecture v2 as authored,
+ * or `undefined` when it can: v2 needs a named `webhookSecret` so the
+ * control plane can verify `X-Hub-Signature` before any compute starts.
+ */
+export function bitbucketChannelArchitectureError(definition) {
+    const options = getBitbucketChannelOptions(definition);
+    if (options === undefined) {
+        return undefined;
+    }
+    return namedWebhookSecretArchitectureError({
+        option: "bitbucketChannel webhookSecret",
+        webhookSecret: options.webhookSecret,
+        envName: BITBUCKET_WEBHOOK_SECRET_ENV,
+        verifies: "X-Hub-Signature",
+    });
+}
+/**
+ * The route policy for a Bitbucket webhook whose secret is named: verify
+ * `X-Hub-Signature` under the env var / deployment secret `secretName`.
+ * Being an {@link hmacSignatureAuth} policy, `deploy` writes it into the
+ * manifest, so on Cursor hosting the control plane runs the same check at
+ * ingestion and refuses a bad signature before any compute starts.
+ */
+export function bitbucketWebhookSignatureAuth(secretName) {
+    return hmacSignatureAuth({
+        header: BITBUCKET_SIGNATURE_HEADER,
+        secret: secretName,
+        prefix: BITBUCKET_SIGNATURE_PREFIX,
+    });
+}
+/**
+ * Default route auth for the resolved webhook secret:
+ *
+ * - A named secret makes the HMAC the route policy itself
+ *   ({@link bitbucketWebhookSignatureAuth}), which is also what makes the
+ *   channel catchable on the control plane.
+ * - A literal or getter secret keeps the HMAC inside the handler, so the
+ *   route admits everything (allowAll) and the handler is the request auth.
+ * - No secret: prod stays loopback-strict; `--dev` admits loopback only.
+ *   `isDevMode()` is read per request: channel modules construct at import.
+ */
+function defaultBitbucketRouteAuth(webhookSecret) {
+    if (webhookSecret === undefined) {
+        return [(request, info) => (isDevMode() ? loopbackOnly() : localDevStrict())(request, info)];
+    }
+    if (isSecretRef(webhookSecret)) {
+        return [bitbucketWebhookSignatureAuth(webhookSecret.secretName)];
+    }
+    return [allowAll()];
+}
 export function bitbucketChannel(options = {}) {
-    var _a, _b, _c;
-    const routePath = (_a = options.path) !== null && _a !== void 0 ? _a : "/";
-    // With a hook secret the `X-Hub-Signature` HMAC is the request auth
-    // (allowAll), matching GitHub HMAC + webhookSecret. Without one, prod stays
-    // loopback-strict; `--dev` admits loopback only. `isDevMode()` and the
-    // secret are read per request: channel modules construct at import time.
-    const auth = (_b = options.auth) !== null && _b !== void 0 ? _b : [
-        (request, info) => (resolveBitbucketWebhookSecret(options) !== undefined
-            ? allowAll()
-            : isDevMode()
-                ? loopbackOnly()
-                : localDevStrict())(request, info),
-    ];
-    const channelOptions = Object.assign({}, options);
+    const routePath = options.path ?? "/";
+    // The env fallback is named, not read, so it deploys like an authored
+    // `{ secretName: "BITBUCKET_WEBHOOK_SECRET" }` and the handler resolves
+    // the same name per request.
+    const webhookSecret = options.webhookSecret ?? envSecretRef(BITBUCKET_WEBHOOK_SECRET_ENV);
+    const auth = options.auth ?? defaultBitbucketRouteAuth(webhookSecret);
+    const channelOptions = { ...options, webhookSecret };
     if (channelOptions.continuation !== undefined) {
         channelOptions.continuation = normalizeIdentity(channelOptions.continuation, BITBUCKET_CHANNEL_KIND);
     }
@@ -49,11 +88,11 @@ export function bitbucketChannel(options = {}) {
                 ? parseCursorBitbucketRepoScope(options.cursorAccount.repos)
                 : undefined,
         };
-    const proxy = () => cursorAccount === null || cursorAccount === void 0 ? void 0 : cursorAccount.credentials.getProxyTransport();
+    const proxy = () => cursorAccount?.credentials.getProxyTransport();
     const definition = defineChannel({
         auth,
         state: emptyBitbucketChannelState(),
-        events: (_c = options.events) !== null && _c !== void 0 ? _c : {},
+        events: options.events ?? {},
         onStart: options.onStart,
         onStop: options.onStop,
         meta: {
@@ -64,25 +103,40 @@ export function bitbucketChannel(options = {}) {
             POST(routePath, {
                 bodySchema: z.unknown(),
                 description: "Bitbucket webhook ingress",
-                handler: (request, args) => __awaiter(this, void 0, void 0, function* () {
-                    return handleBitbucketWebhookRequest({
-                        options: channelOptions,
-                        request,
-                        args,
-                        proxy,
-                    });
+                handler: async (request, args) => handleBitbucketWebhookRequest({
+                    options: channelOptions,
+                    request,
+                    args,
+                    proxy,
                 }),
             }),
         ],
     });
     bitbucketChannelOptionsByDefinition.set(definition, channelOptions);
     if (cursorAccount !== undefined) {
-        registerBitbucketCursorAccountRuntime(definition, Object.assign({ options: channelOptions }, cursorAccount));
+        registerBitbucketCursorAccountRuntime(definition, {
+            options: channelOptions,
+            ...cursorAccount,
+        });
     }
     attachHostedAdmissionAdapter(definition, {
         kind: BITBUCKET_CHANNEL_KIND,
         prepareArgs: withPropagatingBackgroundErrors,
-        dispatch: (_a) => __awaiter(this, [_a], void 0, function* ({ eventType, payload, deliveryId, args }) {
+        dispatch: async ({ channelId, eventType, payload, deliveryId, args }) => {
+            // A named-secret catch is an http.request envelope the control plane
+            // already verified with the deployment secret. Replay it into the
+            // route handler, which verifies X-Hub-Signature a second time.
+            // Cursor-account deliveries carry a Bitbucket event key and stay on
+            // dispatchBitbucketWebhook.
+            if (eventType === AGENT_SDK_CATCH_EVENT_TYPE) {
+                return replayCatchRequest({
+                    channelId: channelId ?? BITBUCKET_CHANNEL_KIND,
+                    deliveryId,
+                    routes: definition.routes ?? [],
+                    payload,
+                    args,
+                });
+            }
             const delivery = parseBitbucketWebhookPayload(payload, eventType);
             if (delivery === null) {
                 return Response.json({ ok: false, error: "invalid_bitbucket_payload" }, { status: 400 });
@@ -94,25 +148,24 @@ export function bitbucketChannel(options = {}) {
                 args,
                 proxy,
             });
-        }),
+        },
     });
     return definition;
 }
 export function findBitbucketChannelTargets(mounts) {
-    var _a, _b, _c;
     const targets = [];
     for (const { slug, project } of mounts) {
         for (const channel of project.channels) {
             const meta = channel.definition.meta;
-            if ((meta === null || meta === void 0 ? void 0 : meta.kind) !== BITBUCKET_CHANNEL_KIND) {
+            if (meta?.kind !== BITBUCKET_CHANNEL_KIND) {
                 continue;
             }
-            const postRoute = ((_a = channel.definition.routes) !== null && _a !== void 0 ? _a : []).find(route => route.method === "POST");
+            const postRoute = (channel.definition.routes ?? []).find(route => route.method === "POST");
             targets.push({
                 slug,
                 channelId: channel.id,
-                routePath: (_b = postRoute === null || postRoute === void 0 ? void 0 : postRoute.path) !== null && _b !== void 0 ? _b : "/",
-                events: [...((_c = meta.bitbucketWebhookEvents) !== null && _c !== void 0 ? _c : [])],
+                routePath: postRoute?.path ?? "/",
+                events: [...(meta.bitbucketWebhookEvents ?? [])],
             });
         }
     }

package/dist/channels/bitbucket/bitbucket-webhook.d.ts

@@ -1,8 +1,19 @@
 import type { ChannelHandlerArgs } from "../../types.js";
 import type { BitbucketProxyTransport } from "./api.js";
 import type { BitbucketChannelOptions, BitbucketEventContext, BitbucketWebhookDelivery } from "./types.js";
+/** Env var / deployment secret an omitted `webhookSecret` falls back to. */
+export declare const BITBUCKET_WEBHOOK_SECRET_ENV = "BITBUCKET_WEBHOOK_SECRET";
+/** Header both dialects sign deliveries with; `sha256=<hex hmac of the raw body>`. */
+export declare const BITBUCKET_SIGNATURE_HEADER = "x-hub-signature";
+export declare const BITBUCKET_SIGNATURE_PREFIX = "sha256=";
 /** `BITBUCKET_WEBHOOK_SECRET` fallback for {@link BitbucketChannelOptions.webhookSecret}. */
 export declare function envBitbucketWebhookSecret(): string | undefined;
+/**
+ * The secret's value for the handler's own signature check. A named secret
+ * resolves from the environment (locally the shell's, hosted the bound
+ * deployment secrets); an unset field falls back to
+ * `BITBUCKET_WEBHOOK_SECRET`.
+ */
 export declare function resolveBitbucketWebhookSecret(options: Pick<BitbucketChannelOptions, "webhookSecret">): string | undefined;
 /** The `X-Hub-Signature` value Bitbucket sends for a raw body. */
 export declare function signBitbucketWebhookBody(rawBody: string | Buffer, secret: string): string;

package/dist/channels/bitbucket/bitbucket-webhook.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bitbucket-webhook.d.ts","sourceRoot":"","sources":["../../../src/channels/bitbucket/bitbucket-webhook.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAqB,kBAAkB,EAAa,MAAM,gBAAgB,CAAC;AACvF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AAyBxD,OAAO,KAAK,EACV,uBAAuB,EAEvB,qBAAqB,EAGrB,wBAAwB,EACzB,MAAM,YAAY,CAAC;AAEpB,6FAA6F;AAC7F,wBAAgB,yBAAyB,IAAI,MAAM,GAAG,SAAS,CAG9D;AAED,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,IAAI,CAAC,uBAAuB,EAAE,eAAe,CAAC,GACtD,MAAM,GAAG,SAAS,CAKpB;AAID,kEAAkE;AAClE,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAEzF;AAED;;;;GAIG;AACH,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,MAAM,GAAG,MAAM,EACxB,eAAe,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC1C,MAAM,EAAE,MAAM,GACb,OAAO,CAWT;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,OAAO,EAChB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GACvB,wBAAwB,GAAG,IAAI,CA2BjC;AAyED,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,wBAAwB,GACjC,IAAI,CAAC,qBAAqB,EAAE,MAAM,GAAG,WAAW,GAAG,WAAW,GAAG,MAAM,CAAC,GAAG,IAAI,CAyBjF;AAwGD;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAAC,KAAK,EAAE;IACpD,OAAO,EAAE,uBAAuB,CAAC;IACjC,QAAQ,EAAE,wBAAwB,CAAC;IACnC,IAAI,EAAE,kBAAkB,CAAC;IACzB,+EAA+E;IAC/E,KAAK,CAAC,EAAE,MAAM,uBAAuB,GAAG,SAAS,CAAC;CACnD,GAAG,OAAO,CAAC,QAAQ,CAAC,CAgHpB;AAED;;;;;GAKG;AACH,wBAAsB,6BAA6B,CAAC,KAAK,EAAE;IACzD,OAAO,EAAE,uBAAuB,CAAC;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,kBAAkB,CAAC;IACzB,qEAAqE;IACrE,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,KAAK,CAAC,EAAE,MAAM,uBAAuB,GAAG,SAAS,CAAC;CACnD,GAAG,OAAO,CAAC,QAAQ,CAAC,CAwCpB"}
+{"version":3,"file":"bitbucket-webhook.d.ts","sourceRoot":"","sources":["../../../src/channels/bitbucket/bitbucket-webhook.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAqB,kBAAkB,EAAa,MAAM,gBAAgB,CAAC;AACvF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AAyBxD,OAAO,KAAK,EACV,uBAAuB,EAEvB,qBAAqB,EAGrB,wBAAwB,EACzB,MAAM,YAAY,CAAC;AAEpB,4EAA4E;AAC5E,eAAO,MAAM,4BAA4B,6BAA6B,CAAC;AACvE,sFAAsF;AACtF,eAAO,MAAM,0BAA0B,oBAAoB,CAAC;AAC5D,eAAO,MAAM,0BAA0B,YAAY,CAAC;AAEpD,6FAA6F;AAC7F,wBAAgB,yBAAyB,IAAI,MAAM,GAAG,SAAS,CAG9D;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,IAAI,CAAC,uBAAuB,EAAE,eAAe,CAAC,GACtD,MAAM,GAAG,SAAS,CAEpB;AAID,kEAAkE;AAClE,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAEzF;AAED;;;;GAIG;AACH,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,MAAM,GAAG,MAAM,EACxB,eAAe,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC1C,MAAM,EAAE,MAAM,GACb,OAAO,CAWT;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,OAAO,EAChB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GACvB,wBAAwB,GAAG,IAAI,CA2BjC;AAyED,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,wBAAwB,GACjC,IAAI,CAAC,qBAAqB,EAAE,MAAM,GAAG,WAAW,GAAG,WAAW,GAAG,MAAM,CAAC,GAAG,IAAI,CAyBjF;AAwGD;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAAC,KAAK,EAAE;IACpD,OAAO,EAAE,uBAAuB,CAAC;IACjC,QAAQ,EAAE,wBAAwB,CAAC;IACnC,IAAI,EAAE,kBAAkB,CAAC;IACzB,+EAA+E;IAC/E,KAAK,CAAC,EAAE,MAAM,uBAAuB,GAAG,SAAS,CAAC;CACnD,GAAG,OAAO,CAAC,QAAQ,CAAC,CAgHpB;AAED;;;;;GAKG;AACH,wBAAsB,6BAA6B,CAAC,KAAK,EAAE;IACzD,OAAO,EAAE,uBAAuB,CAAC;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,kBAAkB,CAAC;IACzB,qEAAqE;IACrE,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,KAAK,CAAC,EAAE,MAAM,uBAAuB,GAAG,SAAS,CAAC;CACnD,GAAG,OAAO,CAAC,QAAQ,CAAC,CAwCpB"}